Questions and responses 45th Parliament, 1st session May 26, 2025, to present

With regard to incidents involving Microsoft's cloud services referenced in the "National Cyber Threat Assessment 2025-2026" and, specifically, the compromise of Microsoft Exchange Online during the summer of 2023, the breach of Microsoft's cloud-based enterprise service by Russian state-sponsored actors in January 2024, and the Azure disruption in July 2024: (a) which government departments or agencies were impacted by the compromise of Microsoft Exchange Online in the summer of 2023; (b) which government departments or agencies were impacted by Russian state-sponsored actors accessing Microsoft's corporate email accounts in January 2024; (c) which government departments or agencies were impacted by the Microsoft Azure cloud service disruption in July 2024; and (d) for the incidents in (a), (b), and (c), what was the (i) nature, (ii) date, (iii) duration, of the impact on government operations?

With regard to follow-up questions on cyberattacks provided to the Standing Committee on Government Operations and Estimates concerning the appearance of Shared Services Canada on March 12, 2026, where it was stated in the follow-up question submission that approximately 7.7 trillion cyber events were blocked in 2025: (a) what proportion of these cyber events were attributed to foreign sources; (b) what are the countries or regions of origin of these foreign-attributed cyber events, broken down by total number and percentage; (c) what methodology is used by Shared Services Canada to determine the origin or attribution of cyber events; and (d) how many of these cyber events were assessed to be state-sponsored or linked to foreign governments, broken down by country or region?